4.2 KiB
4.2 KiB
[*] http on tcp/80
[-] (feroxbuster) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:
feroxbuster -u http://node-red.lan.ddnsgeek.com:80 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r -o /root/results/node-red.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt
[-] Credential bruteforcing commands (don't run these without modifying them):
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/root/results/node-red.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_auth_hydra.txt" http-get://node-red.lan.ddnsgeek.com/path/to/auth/area
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/root/results/node-red.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_auth_medusa.txt" -M http -h node-red.lan.ddnsgeek.com -m DIR:/path/to/auth/area
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/root/results/node-red.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_form_hydra.txt" http-post-form://node-red.lan.ddnsgeek.com/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/root/results/node-red.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_form_medusa.txt" -M web-form -h node-red.lan.ddnsgeek.com -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"
[-] (wpscan) WordPress Security Scanner (useful if WordPress is found):
wpscan --url http://node-red.lan.ddnsgeek.com:80/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color 2>&1 | tee "/root/results/node-red.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_wpscan.txt"
[*] https on tcp/443
[-] (feroxbuster) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:
feroxbuster -u https://node-red.lan.ddnsgeek.com:443 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r -o /root/results/node-red.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_feroxbuster_dirbuster.txt
[-] Credential bruteforcing commands (don't run these without modifying them):
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 443 -o "/root/results/node-red.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_auth_hydra.txt" https-get://node-red.lan.ddnsgeek.com/path/to/auth/area
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 443 -O "/root/results/node-red.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_auth_medusa.txt" -M http -h node-red.lan.ddnsgeek.com -m DIR:/path/to/auth/area
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 443 -o "/root/results/node-red.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_form_hydra.txt" https-post-form://node-red.lan.ddnsgeek.com/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 443 -O "/root/results/node-red.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_form_medusa.txt" -M web-form -h node-red.lan.ddnsgeek.com -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"
[-] (wpscan) WordPress Security Scanner (useful if WordPress is found):
wpscan --url https://node-red.lan.ddnsgeek.com:443/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color 2>&1 | tee "/root/results/node-red.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_wpscan.txt"